Log in Start free

Vulnerability · Published Sep 11, 2023 · Assigned by mozilla

CVE-2023-4583Browsing Context potentially not cleared when closing Private Window

High 7.5

In plain English

A high-severity security flaw in Firefox from Mozilla. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 53% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.7%top 47.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

When checking if the Browsing Context had been discarded in `HttpBaseChannel`, if the load group was not available then it was assumed to have already been discarded which was not always the case for private channels after the private session had ended. This vulnerability affects Firefox < 117, Firefox ESR < 115.2, and Thunderbird < 115.2.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:8firefox102.15.0-1.el8_8.almaALSA-2023:4952
AlmaLinux:9firefox102.15.0-1.el9_2.almaALSA-2023:4958
AlmaLinux:9firefox-x11102.15.0-1.el9_2.almaALSA-2023:4958
AlmaLinux:8thunderbird102.15.0-1.el8_8.almaALSA-2023:4954
AlmaLinux:9thunderbird102.15.0-1.el9_2.almaALSA-2023:4955
Alpine:v3.20firefox-esr115.2.0-r0ALPINE-CVE-2023-4583
Alpine:v3.21firefox-esr115.2.0-r0ALPINE-CVE-2023-4583
Alpine:v3.22firefox-esr115.2.0-r0ALPINE-CVE-2023-4583
Alpine:v3.23firefox-esr115.2.0-r0ALPINE-CVE-2023-4583
Debian:13firefox-esr115.2.0esr-1DEBIAN-CVE-2023-4583
Debian:14firefox-esr115.2.0esr-1DEBIAN-CVE-2023-4583
Debian:13thunderbird1:115.2.0-1DEBIAN-CVE-2023-4583
Debian:14thunderbird1:115.2.0-1DEBIAN-CVE-2023-4583
Rocky Linux:8firefox0:102.15.0-1.el8_8RLSA-2023:4952
Rocky Linux:8thunderbird0:102.15.0-1.el8_8RLSA-2023:4954
Ubuntu:22.04:LTSmozjs102no fix listedUBUNTU-CVE-2023-4583
Ubuntu:24.04:LTSmozjs102no fix listedUBUNTU-CVE-2023-4583
Ubuntu:22.04:LTSmozjs78no fix listedUBUNTU-CVE-2023-4583
Ubuntu:22.04:LTSmozjs91no fix listedUBUNTU-CVE-2023-4583
Ubuntu:22.04:LTSthunderbird1:115.3.1+build1-0ubuntu0.22.04.2UBUNTU-CVE-2023-4583
Ubuntu:22.04:LTSthunderbird1:115.3.1+build1-0ubuntu0.22.04.2USN-6405-1

Affected products (as reported)

VendorProductVersions
Mozilla Firefox unspecified – before 117
Mozilla Firefox ESR unspecified – before 115.2
Mozilla Thunderbird unspecified – before 115.2

Weakness: CWE-754 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

References